Partner with architects, product owners, and development teams during design and planning phases to embed secure-by-design principles.
Conduct and validate application security testing (automated and manual), including intake and validation of findings from external penetration tests and bug bounty programs.
Accountabilities
Individual Accountabilities
Support vulnerability management processes, including triage, exception review, remediation, and reporting.
Conduct application and architecture-level Threat Modeling for new applications, major enhancements, and high-risk changes.
Support uplift of Threat Modeling maturity by defining templates, playbooks, and reusable threat libraries for common platforms and patterns.
Support to scale workstreams such as secrets, SCA, SAST, DAST vulnerability remediation.
Partner with development teams to integrate security expectations into CI/CD pipelines and DevSecOps workflows.
Validate and contextualize findings from automated tools, penetration tests, and external assessments where design-level issues are identified.
Key Shared Accountabilities
Partner with Global Application Security on standards, tooling and continuous improvement
Collaborate with CIO, engineering, and architecture teams to ensure consistent adoption and accountability
Align with Vulnerability Management function on remediation prioritization and risk treatment
Support audit, regulatory, and control assurance activities
Required Qualifications
Minimum 5+ years in application security or software development roles with a focus on secure coding and DevSecOps.
Strong understanding of application security principles, SDLC, and CI/CD pipelines.
Strong understanding of application penetration testing
Knowledge of secure coding standards and frameworks (e.g., OWASP Top 10, NIST).
Excellent collaboration and communication skills to engage developers and stakeholders.
Preferred Qualifications
Hands-on experience with security tools (e.g., Secrets, SCA, SAST, Container security, DAST) and automation frameworks.
Familiarity with cloud-native application security concepts.
Certifications: OSCP, CISSP or preferred equivalent.
Additional certifications such as Advanced application testing certifications (OSWP, GIAC GWAPT, INE eWPTX) are considered an advantage.
Tooling and Technology Coverage
In addition to SAST, DAST, and SCA, familiarity with complementary controls such as WAF and NAC were relevant to application-layer protection.
Practical exposure to API security, Kubernetes and container platforms, Infrastructure as Code (IaC), hybrid cloud environments, and penetration testing or vulnerability scanning toolchains.
When you join our team
We’ll empower you to learn and grow the career you want.
We’ll recognize and support you in a flexible environment where well-being and inclusion are more than just words.
As part of our global team, we’ll support you in shaping the future you want to see.
About Manulife and John Hancock
Manulife Financial Corporation is a leading international financial services provider, helping people make their decisions easier and lives better. To learn more about us, visit https://www.manulife.com/en/about/our-story.html.
Manulife is an Equal Opportunity Employer
At Manulife/John Hancock, we embrace our diversity. We strive to attract, develop and retain a workforce that is as diverse as the customers we serve and to foster an inclusive work environment that embraces the strength of cultures and individuals. We are committed to fair recruitment, retention, advancement and compensation, and we administer all of our practices and programs without discrimination on the basis of race, ancestry, place of origin, colour, ethnic origin, citizenship, religion or religious beliefs, creed, sex (including pregnancy and pregnancy-related conditions), sexual orientation, genetic characteristics, veteran status, gender identity, gender expression, age, marital status, family status, disability, or any other ground protected by applicable law.
It is our priority to remove barriers to provide equal access to employment. A Human Resources representative will work with applicants who request a reasonable accommodation during the application process. All information shared during the accommodation request process will be stored and used in a manner that is consistent with applicable laws and Manulife/John Hancock policies. To request a reasonable accommodation in the application process, contact hr@manulife.com.
Working Arrangement
Hybrid
